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REMARKS 

Claims 1-37 are pending in the application. Claims 1-37 have been rejected. 

Re jection o f Claims under 35 U.S.C. $ 102 

Claims 1-10 stand rejected under 35 U.S.C. § 102(b) as being anticipated by Tajalli, et 
al., U.S. Patent 5,361,359 ("Tajalli"). Applicants respectfully traverse this rejection. 

Independent claim 1 is repeated below: 

An apparatus for creating an audit trail for an application program, wherein the 
application program defines one or more business components and is executable 
on an application server, the apparatus comprising: 

means for selecting: 

the business components to be audited from the one or more business 

components; and 
one or more operations to be audited; 

wherein the means for selecting the business components to be audited and the 
operations to be audited is included in the application program. 

Tajalli does not teach "wherein the means for selecting the business components to be 
audited and the operations to be audited is included in the application program," which is 
required by independent claim 1. The Office Action states that the teaching of the "means for 
selecting ... is included in the application program" is implicit, citing Tajalli, column 4, lines 54- 
59, and column 16, lines 23-24. (See Office Action dated December 15, 2004, page 2, paragraph 
2, through page 3.) Applicants respectfully submit that the teachings of Tajalli have been 
misinterpreted. Rather than implicitly teaching that the "means for selecting ... is included in the 
application program," Tajalli instead teaches away from such a conclusion, as will be further 
explained below. 

The cited portion of column 4, in context, is provided below: 

. . . what is needed is a computer system which enables an administrator to reliably 
control what application programs are executed, and which provides the 
administrator with a reliable audit trail of how it has been used. 
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Applicants respectfully point out that the cited portion of column 4, when taken in 
context, does not show that the "means for selecting" is included in the application program. 
The computer system "enables the administrator to control what application programs are 
executed, and . . . provides the administrator with a reliable audit trail of how it [which 
Applicants interpret as the computer system] has been used." Nothing indicates that the 
application programs themselves contain the means for selecting. Moreover, Applicants 
specifically point out the following excerpt from Tajalli, column 15, lines 20-24: 

. . . neither application programs 514 nor ordinary users 128 (even those privileged 
with respect to the underlying operating system) can affect the auditing or the 
storage of usage auditing in any way. 

If the application programs cannot affect the auditing in any way, then the application 
programs cannot include means "for selecting the business components to be audited and the 
operations to be audited." Applicants respectfully submit that, rather than implicitly teaching 
that the application programs include the "means for selecting . . .," Tajalli teaches away from 
including the means for selecting in the application programs themselves. 

Because all of the limitations of independent claim 1 are not taught by Tajalli, 
independent claim 1 and its dependent claims 2-13 are allowable for at least this reason. 

Rejection of Claims under 35 U.S.C. $ 103 

Claims 12-22, 24-32 and 34-37 stand rejected under 35 U.S.C. § 103(a) as being 
unpatentable over Tajalli in view of Smaha, et al., U.S. Patent 5,557,742 ("Smaha"). Applicants 
respectfully traverse these rejections. Rejections of independent claims 14 and 24 are addressed 
first, following the format of the Office Action. Rejections of dependent claims 12-13, 15-22, 
and 25-37 based upon the combination of Tajalli and Smaha are discussed thereafter. 

Independent Claims 

Independent claim 14 is repeated below: 

A system for creating an audit trail in an information system, comprising: 
an application program comprising: 

at least one business component, wherein each business component includes one 
or more fields; 
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a user interface operable to allow a user to select: 
one or more of the fields, and 

one or more operations to be audited on one or more of the selected fields; 
a set of instructions operable to detect when the selected operations are performed 

on the selected fields; and 
a set of instructions operable to generate an audit transaction record regarding one 

or more of the selected fields when the selected operations are detected. 

Taj alii and Smaha, even when combined, do not teach all of the limitations of 
independent claim 14. The application program claimed includes at least one business 
component, a user interface, a "set of instructions operable to detect when the selected operations 
are performed. . .," and a "set of instructions operable to generate an audit transaction record. ..." 
The Office Action states that each of these components is taught at least in part by Taj alii, but 
Applicants respectfully disagree. For example, the Office Action states that the "user interface 
operable to allow a user to select: one or more of the fields, and one or more operations to be 
audited on one or more of the selected fields" is taught in part by the user interface of Taj alii' s 
Assured Audit (AA) system. (Office Action dated December 15, 2004, page 5, paragraph 3.) 
However, the AA system employs a trusted path mechanism and collects audit information about 
the activities of ordinary users and application programs. (See Tajalli, column 6, lines 63 
through column 7 line 1). The application programs themselves do not provide the user interface 
for selecting fields and/or operations to be audited, but rather are the targets of the audit process 
performed by the AA system. The user interface component of the claimed application program 
is not taught by Tajalli. 

The Office Action states that Smaha teaches "one or more fields selectable by a user," 
citing Smaha Fig. 6b. In Smaha Figure 6b, a "Generate Report" step 170 is followed by a 
"Display Predefined Fields" step 172 and a "User Selects Fields" decision point 174. The report 
is generated prior to the user's selection of fields, and then the data is passed to a "Format 
Report" step 178. Smaha merely teaches selection of predefined fields on a report prior to 
formatting the report. In contrast, the performance of operations on fields that are selected using 
the claimed user interface are detected as the operations occur and are used to generate an audit 
transaction record. Neither Tajalli nor Smaha, taken alone or in combination, teaches the "user 
interface operable to allow a user to select: one or more of the fields, and one or more operations 
to be audited on one or more of the selected fields." 
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Furthermore, the "set of instructions operable to detect when the selected operations are 
performed on the selected fields" are not included in the application programs that are being 
audited. The Office Action cites the following portion of Tajalli: 

. . . carrying out a request by an administrator to modify the approved 
application set which resides on said protected media, wherein said 
operating system exits said trusted path mode and enters said general 
purpose mode upon detecting a request to do so by the administrator; . . . 

Applicants respectfully submit that the cited portion of Tajalli refers to functionality of the 
operating system under which the AA system and the application programs are running, rather 
than to functionality of the application programs themselves. 

Similarly, the Office Action cites the following portion of Tajalli as teaching the "set of 
instructions operable to generate an audit transaction record regarding one or more of the 
selected fields when the selected operations are detected:" 

The AA system collects audit information as specified by the 
configuration data and generates audit logs from the information. 

Applicants respectfully submit that the generation of audit transaction records is not a function of 
the application programs themselves, but rather a function of the AA system that audits the 
activities performed by the application programs. 

Because Tajalli and Smaha, taken alone or in combination, do not teach all of the 
limitations of the claimed application program of independent claim 14, independent claim 14 
and its dependent claims 15-23 are allowable. 

Independent claim 24 is repeated below: 

A method for creating an audit trail in an information system, the method comprising: 
performing audit trail functions in an application program including: 

generating a list of business components included in the application program; 

presenting the list of business components to a user; 

allowing the user to select one or more of the business components to be audited; 
presenting a list of operations that can be performed on the business components 
to the user; 

allowing the user to select one or more of the operations to be audited for the 
selected business components. 
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Applicants respectfully submit that Tajalli and Smaha, taken alone or in combination, do 
not teach, inter alia, "performing audit trail functions in an application program." Applicants 
have shown above with reference to independent claim 14 that the combination of Tajalli and 
Smaha do not teach an application program with the following functionality: allowing a user to 
select one or more of the fields, and one or more operations to be audited on one or more of the 
selected fields; detecting when the selected operations are performed; or generating an audit 
transaction record. Furthermore, Applicants refer again to the following excerpt from Tajalli: 

. . . neither application programs 514 nor ordinary users 128 (even those privileged 
with respect to the underlying operating system) can affect the auditing or the 
storage of usage auditing in any way. 

If the application programs cannot affect the auditing in any way, then it cannot be said 
that Tajalli "perform[s] audit trail functions in an application program." Consequently, all 
limitations of independent claim 24 are not taught by Tajalli and Smaha, and independent claim 
24 and its dependent claims 25-37 are allowable for at least this reason. 

Also with regard to independent claim 24, the Office Action refers to Tajalli, column 1, 
lines 24-38, which states the following: 

. . . The need to control how computer systems are used is related to organizational 
goals. For example, a business might want to protect inventory records from 
unauthorized modifications. . . . 

This statement is a general, introductory background statement regarding the types of 
data that businesses may wish to control and protect. Applicants respectfully disagree that the 
statement teaches "generating a list of business components included in the application 
program," the limitation for which the statement is cited. The fact that organizations may use 
computer systems to track "inventory records" is unrelated to the generation of business 
components by an application program. Applicants respectfully submit that "generating a list of 
business components included in the application program" is not taught by Tajalli and/or Smaha, 
taken alone or in combination. Consequently, independent claim 24 and its dependent claims 25- 
37 are allowable for at least this reason. 
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Dependent claims 

Claims 12 and 34 are rejected for the same reasons as independent claim 14, which 
Applicants have shown to be allowable. Furthermore, independent claim 1, its dependent claims 
including claim 12, independent claim 24, and its dependent claim including claim 34 have also 
been shown to be allowable over Taj alii and Smaha, taken alone or in combination. 
Consequently, dependent claims 12 and 34 are allowable for at least the foregoing reasons. 

Claims 13, 22, and 35 are rejected in part based upon the following excerpt from column 
9, lines 49-55 of Smaha: 

The set of states 116 that the present embodiment locates from data structure 108 
may be as empty or large as necessary to represent all the states in the sequence of 
actions which result in the misuse. Any set of events may also include the initial 
event 1 12 or events in previous sets. The effect of transitioning to the initial state 
is to reset the sequence of actions to the initial state. 

This statement is said to teach "allowing the user to restore one or more of the fields to a 
previous state or value." Applicants respectfully disagree. No user interaction is described with 
reference to the states. Furthermore, Applications believe that the "resetting" of the sequence of 
actions to the initial state described is a reference to housekeeping within data structure 108 
rather than a description of functionality provided to the user. Applicants therefore believe that 
the rejection of claims 13, 22, and 35 based upon this cited portion of Smaha is in error. 

The pairs of claims 15 and 25, 16 and 26, 17 and 28, 18 and 29, 19 and 30, and 20 and 
31, and 21 and 32 are rejected for the same reasons as, respectively, individual claims 4, 5, 6, 7, 
8, 9, and 10 above, all of which have been shown to be allowable over the combination of Tajalli 
and Smaha. Claim 27 is rejected for the same reasons as claims 2 and 3, which have been shown 
to be allowable over the combination of Tajalli and Smaha. Claims 36 and 37 are rejected for 
the same reasons as independent claim 24, which has been shown to be allowable over the 
combination of Tajalli and Smaha for the foregoing reasons. 

In summary, independent claims 1, 14, and 24 and respective dependent claims 2-13, 15- 
23, and 25-37 have been shown to be allowable for at least the foregoing reasons. 
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Claim 11 stands rejected under 35 U.S.C. § 103(a) as being unpatentable over Tajalli in 
view of Darnell et al., U.S. Patent 5,596,700 ("Darnell"). Applicants respectfully traverse this 
rejection. 

Applicants respectfully disagree that Darnell teaches "prompting the user to enter a 
comment or a description of the operation when the selected operations are detected." Darnell 
teaches a system for annotating software windows. The following stated in the cited portion of 
column 3, lines 19-24 of Darnell: 

The "new note mode" is entered upon detecting a selected action by a user. This 
action may be clicking the mouse button when the pointer is activated on a 
command field in a pull-down menu or any equivalent action. The system then 
allows the user to move the pointer to the location where the note is desired. 

Darnell does not teach prompting the user to enter a command or a description of the 
operation when the selected operations are detected. The user is prompted to enter text in 
reaction to the user clicking a mouse button or other equivalent action with respect to a user 
interface, which provides functionality in response to those user actions. The user is not 
prompted in response to detecting an operation that has been selected for auditing. Furthermore, 
the text entered by the user does not describe the operation detected, such as the operation of 
clicking on the mouse button; instead, the text is associated with a window of the user interface. 
Because the combination of Tajalli does not teach all limitations of dependent claim 11, 
dependent claim 1 1 is allowable for at least this reason. 

Claims 23 and 33 stand rejected under 35 U.S.C. § 103(a) as being unpatentable over 
Tajalli and Smaha further in view of Darnell. Claims 23 and 33 are rejected for the same reasons 
as dependent claim 11, which has been shown to be allowable over the combination of Tajalli 
and Darnell. Claims 23 and 33 are therefore allowable for at least the foregoing reasons. 
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CONCLUSION 

In view of the remarks set forth herein, the application is believed to be in condition for 
allowance and a notice to that effect is solicited. Nonetheless, should any issues remain that 
might be subject to resolution through a telephonic interview, the Examiner is invited to 
telephone the undersigned at 5 12-439-5086. 



I hereby certify that this correspondence is being deposited with 
the United States Postal Service as First Class Mail in an envelope 
addressed to: Mail Stop Amendment, COMMISSIONER FOR 
PATENTS, P. O. Box 1450, Alexandria, VA 22313-1450, on 
March 15,2005. 



Attorney for Applicants) Date of Signature 



Respectfully submitted, 

D'AnnNaylorRifai & 
Attorney for Applicants 
Reg. No. 47,026 
(512) 439-5086 [Phone] 
(512) 439-5099 [Fax] 
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